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Why Configuration Assessment Matters 


Manage Security Risk, identifying and remediating software 
Vulnerabilities including software Configuration settings, 
Misuse & Flaws 


Manage Compliance, reviewing applicable Mandates, 
applying best practice Policies & Controls performing 
regular Audit 


© QUALYS 


Why Configuration Assessment Matters 


Successful organizations collect & use more configuration data 
from 81% of their IT Systems to manage their risk & compliance 


(Source: IT P olicy Con \plia ce Group) 


Dominant Information Used Managing Business Risk Related to Use of IT 


Information security controls log data 


Systems/software configuration data 
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A Why Configuration Assessment Matters 
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Reduces complexity & cost of = =10= 
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QualysGuard Policy Compliance - Demo 


Automates secure configuration assessment life cycle 


Discover and 
</> 3 
pS Organize 


Report and Secure Configuration Define Security 
Remediate Policies 
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Audit against 
defined policies 


Automated and continuous cycle @ ous 


Policy Compliance Coverage 


Supported Technologies Core Module 


Windows (Windows XP to Windows 2012) Rich Policy Editor UI 

Unix/Linux (AIX 6/7, RHEL 5/6, SuSE 10/11, Solaris 10/11, - Simple and Intuitive 
HP-UX 11.x) - Search Capability 

Databases (SQL 2008/2012, Oracle 10, 11g, DB2) - External References 

Virtualization (VMware ESX 4.x, ESXi 5.x) 

Web Servers (IIS 6/7.x, Apache HTTP, VMware vFabric 5.x) User Defined Controls (UDC) 

Middleware (IBM WebSphere Application Server 7.x) > EE content 


Devices (CISCO iOS 12/15), Juniper* & CISCO ASA* = WMI 
- Registry 


bn SCAP 1.25 t 
Supported Policies ARF Report 


CIS Certified, CIS Based, SCM Based, SCAP Certified - Custom OVAL Check 


CIS Based - 2008, 2008 R2 SCAP Certified Policies 


CIS Based - VMware ESXi 4.x and 5.x API Support 

CIS Based - CISCO iOS 12 and 15 - Start/Pause Scan 

CIS Based - Solaris 10.x and 11.x - Single Instance Reports 

CIS Based - SUSE 10 and 11 - Policy merge 

CIS Based - Windows 7, Windows 2012, Win 8* 

CIS Based — AIX 7 Dashboard & Reporting Capabilities 

CIS Based — MS SOL 2012* - Extended Evidence 

CIS Based — IIS 7 - Multi Policy, Technology, Asset Score Card 
SCM Based — Windows 7, Windows 2012* 

Mandate Based Policies — HIPPA, ISO 
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Scalability 


Public and private Cloud infrastructure & services 


Time to value 
Quick and easy to use 


Comprehensive Assessment Coverage: 
Secure Configuration & Vulnerability Assessment 
OS, Databases, Applications & Network Devices 


Interoperability: 
Customization & workflow, API 
Integration with 3 party GRC, SIEM, ... 
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id] Why OualysGuard Policy Compliance 


QUALYSGUARD Dynamic Role-Based User Interface 


+ Vulnerability 
+ Configuration 
+ Identity and Access * Application 
+ Security Configuration 
+ Secure Application 


Baseline 


Policy 
+ Vulnerability 


+ Threat 
+ Asset 


Monitor! ses 
Re 


Vulnerability 
Management Shield 


SIEM 


+ NIPS 
Eliminate + HIPS 
Root Cause + NAC 


+ User Provisioning 
+ System Provisioning 
+ Application Development 


Mitigate 


+ Patch Management 
+ Configuration Management 
+ Change Management 


© 2012 Gartner, Inc. and/or its affiliates. All rights reserved. 
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QUALYSGUARD API 
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Thank You 


Resources 
http://www.gualys.com/enterprises/gualysguard/policy-compliance 


shaghagualys.com 


